The subject matter described herein relates generally, but not exclusively, to credit card security codes. To help place the inventive subject matter described herein in context, we will now explain some of the basic aspects credit card security codes.
In addition to the account number, there are two security codes on a typical credit card: the CVC1 (card verification code 1) or CVV1 (card verification value 1), and the CVC2 or CVV2. The CVC1 is encoded on the magnetic stripe of the card and used for transactions in person. The CVC2 is typically a three- or four-digit sequence printed on the credit card that is not encoded on the magnetic strip. It is often asked for by merchants to secure “card not present” transactions occurring over the Internet, by mail, fax or over the phone.
While the CVC2 offers some additional security to the card, it is typically easy to obtain by anyone with physical access to the card, because it comprises a short sequence of digits, it is printed on the card, and it does not change. It would therefore improve the security of credit cards if those characteristics of the CVC2 could be dynamically modified to enhance the security of a credit card.
There also exists a CVC3, which is not currently in widespread use. The CVC3 is a number that changes with each transaction. However, it is generated by the card, so there is still a security problem when an unauthorized person obtains the card itself, because that person would have access to the CVC3.